Abstract
Current software implementations of network intrusion detection reach a maximum network connection speed of about 1Gbps (Gigabits per second). This paper analyses the Snort software network intrusion detection system to highlight the bottlenecks of such systems. It proposes a novel packet processing engine called UNITE that deploys a uniform hardware architecture to perform both header classification and payload signature extraction utilising a Content Addressable Memory (CAM) which is optimised by techniques based on Binary Decision Diagrams (BDDs). The proposed design has been implemented on an XC2VP30 FPGA, and we achieve an operating frequency of 350MHz and a processing speed in excess of 2.8Gbps. The area resource usage for UNITE is also shown to be efficient, with a Look Up Tables (LUTs) per character ratio of 0.82 for a rule set of approximately 20,000 characters.
This is a preview of subscription content, log in via an institution to check access.
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Sourcefire, Snort - The Open Source Network Intrusion Detection System (2005), http://www.snort.org
Xilinx Inc, Virtex II Pro Platform FPGA (2005), http://www.xilinx.com/products/silicon_solutions/fpgas/virtex
Fenlason, J., Stallman, R.: The GNU Profiler (2005), http://www.gnu.org/software/binutils/manual/gprof-2.9.1/html_mono
Cheswick, W.R., Bellovin, S.M.: Firewalls and Internet Security. Addison-Wesley Professional, Reading (1994)
Zwicky, E.D., Cooper, S., Chapman, B.D.: Building Internet Firewalls, 2nd edn. O’Reilly, Sebastopol (2000)
Boyer, S.R., Moore, S.J.: A Fast String Searching Algorithm, pp. 762–772. ACM Press, New York (1977)
Knuth, D., Morris, J., Pratt, V.: Fast Pattern Matching in Strings. SIAM Journal on Compting, 323–350 (1977)
Stephen, G.A.: String Searching Algorithms. World Scientific Publishing Co., Inc, Singapore (1974)
Yusuf, S., Luk, W.: Bitwise Optimised CAM for Network Intrusion Detection Systems. In: Field Programmable Logic Conference Proceedings, pp. 444–449 (2005)
Attig, M.E., Lockwood, J.: A Framework for Rule Processing in Reconfigurable Network Systems. In: Proc. IEEE Symp. on Field Programmable Custom Computing Machines (2005)
Song, H., Lockwood, J.: Efficient Packet Classification for Network Intrusion Detection using FPGA. In: Proc. IEEE Symp. on Field Programmable Custom Computing Machines (2005)
Bounds, D.: Packit - Network Injection and Capture (2005), http://packit.sourceforge.net/
Xilinx Inc., OPB EMAC (2005), http://www.xilinx.com
Massachusetts Institute of Technology Lincoln Laboratory, DARPA Intrusion Detection Evaluations, http://www.ll.mit.edu/IST/ideval/data/data_index.html
Xilinx Inc., Xilinx University Program (2005), http://www.xilinx.com/univ/
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2006 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Yusuf, S., Luk, W., Szeto, M.K.N., Osborne, W. (2006). UNITE: Uniform Hardware-Based Network Intrusion deTection Engine. In: Bertels, K., Cardoso, J.M.P., Vassiliadis, S. (eds) Reconfigurable Computing: Architectures and Applications. ARC 2006. Lecture Notes in Computer Science, vol 3985. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11802839_47
Download citation
DOI: https://doi.org/10.1007/11802839_47
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-36708-6
Online ISBN: 978-3-540-36863-2
eBook Packages: Computer ScienceComputer Science (R0)